Splunk Search

Pareto charting of sensor data

twistedsixty4
Path Finder

hey everyone,
I'm working with a lot of sensor data and i have been trying to develop a pareto chart to look at the problem children if you will, so our maintenence team can know what devices to focus on. for those of you unfamiliar with Pareto's Principle, it basically states that 80% of your problems stem from 20% of your causes.
http://en.wikipedia.org/wiki/Pareto_principle#In_software

what I want is a scatter plot where the points are the device name, the y-axis is the percentage of total alarms, and the x-axis is the percentage of total devices. but I'm not entirely sure how to get there, here is what I have. thanks for the help.

class=incident subclass=problem incident_problem_type=alarm | eventstats count by unique_unit_name | stats count(unique_unit_name) as count_of_units | eval sum(count) as total
0 Karma

technoe
Explorer

I would consider using timechart to create a pie chart of the number of incidents. Also, I've never used NOT to ignore a value, but instead I would use:

incident_problem_type=alarm incident_problem_type!=camera
0 Karma

twistedsixty4
Path Finder

you can ignore the not camera statement, i use it only so i can see the data i'm evaluating, its not a problem type, but exists inside the alarm problem set.

also this doesn't answer my question, i can do a pie chart of incidents very easily, but its not what i want in the sense of development.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...